CVE-2020-26176
18.12.2020, 10:15
An issue was discovered in tangro Business Workflow before 1.18.1. No (or broken) access control checks exist on the /api/document/<DocumentID>/attachments API endpoint. Knowing a document ID, an attacker can list all the attachments of a workitem, including their respective IDs. This allows the attacker to gather valid attachment IDs for workitems that do not belong to them.Enginsight
| Vendor | Product | Version |
|---|---|---|
| tangro | business_workflow | 𝑥 < 1.18.1 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration